Skip to main content
availability

Package: Invicti AppSec Core (on-demand)

Install internal agent using Docker

Invicti AppSec Core lets you use internal agents to scan targets in your internal environment that aren't publicly accessible from the internet or when you don't want to trustlist Invicti cloud agents.

This document explains how to install the Invicti internal agent using Docker CLI on a Linux or Windows host. In the Add agent dialog, use the Docker tile for a Windows host running Docker, and the Linux tile for a Linux host running Docker - both use the same Docker-based installation method. For other installation methods, refer to:

Limitations for internal agents
  • When the site is internal and you prefer using internal agents for the scan, you can create and import Login Sequence Records (LSRs) through the Docker agent. However, Business Logic Records can only be imported - you can't record them through an internal agent.
  • Docker on Mac is not supported. Installing the agent via Docker on Mac (including Apple Silicon/M-series machines) is not supported and will not function correctly. Scans may appear queued but will not start. Use a supported platform such as Windows or Linux instead.
  • Windows containers are not supported. The published internal agent image is a Linux container image. Running the agent in a Windows container, including images based on mcr.microsoft.com/windows/servercore, is not supported. If your environment requires Windows for authentication reasons such as Kerberos, install the agent directly on a Windows host with the Desktop Experience installation option. Refer to Install an internal agent on Windows.

Prerequisites​

System requirements

To run scans successfully, the agent requires sufficient system resources. The agent only initiates a new scan if the following minimum resources are available:

  • CPU: 2 free cores on a 64-bit processor
  • Memory (RAM): 6 GB available
  • Disk space: 50 GB free

Access requirements

  • Ensure you have Docker Desktop installed on your host OS by verifying with the command docker -v in Terminal. If the Terminal shows you the version information, you're all set. Otherwise, refer to the Docker support documentation for installation guidance.
  • Administrator privileges for command execution.
  • Invicti AppSec Core Administrator role.
  • Ensure you have Docker Desktop installed on your Linux or Windows host OS. Installing on Mac is not supported.

Trustlisting requirements

To allow the internal agent to communicate with Invicti AppSec Core, trustlist the required domains for your region:

Resource allocation behavior

When the agent starts, it checks the available CPU, RAM, and disk space and calculates how many scans it can run in parallel, running the lowest number those resources allow. You can adjust the per-slot thresholds or set a fixed limit. For the calculation details and override options (agent.yaml thresholds, jobs_override, and the --max-jobs flag), refer to Concurrent scans and resource allocation in the internal scanning introduction.

Install the agent using Docker​

  1. Select Scans > DAST agents from the left-side menu.

  2. Click Add new agent.

  3. In the Add agent dialog, enter a name for the agent in the Agent name field. The agent name must not contain any whitespace characters or special characters.

  4. Note the token in the Token field - you'll need it in the installation command.

  5. Click the Docker tile (for a Windows Docker host) or the Linux tile (for a Linux Docker host).

  6. Copy the command from the on-screen instructions.

  7. Open Terminal and execute the command copied from the installation instructions.

In this table you can see the parameters necessary to configure a Docker container for installing the agent.

ParameterDescription
-dThis indicates detached mode, allowing the container to operate in the background.
--nameAssigns a name to the container.
--urlSpecifies the Invicti AppSec URL.
--agentnameDefines the agent name in the Invicti AppSec UI, changeable later. If installing multiple agent instances, assign a unique agent name for each instance. (Max 50 characters)
--registration-tokenIf you run the command from the UI, the token is prefilled for you. If you need to copy the token, you can get it from Scans > DAST agents > Add new agent > Docker > Token.

  1. Click Done to complete the process.

  2. Your agent is now successfully installed. Go to Scans > DAST agents to view and manage your internal agents.

You can now assign targets to the installed agent and start scanning your targets.

Need help?​

Invicti Support team is ready to provide you with technical help. Go to Help Center

Was this page useful?